v8/test/mjsunit/regress/regress-12495.js
Tobias Tebbi f33e68ade1 [builtins] fix Torque fast-path for String.prototype.localeCompare
The fast path has an early return if the two inputs are the same
object. However, this was missing the check that the receiver
is not undefined required by the spec.
This fixes it by first checking that the receiver is a string and
only afterwards checking for reference equality.

Bug: v8:12495
Change-Id: I4c5fc80e09060b013c94b05bbc9da504ddbb5206
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3386602
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78637}
2022-01-17 08:06:48 +00:00

22 lines
493 B
JavaScript

// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function opt() {
try {
Reflect.apply("".localeCompare, undefined, [undefined]);
return false;
} catch(e) {
return true;
}
}
%PrepareFunctionForOptimization(opt);
assertTrue(opt());
assertTrue(opt());
%OptimizeFunctionOnNextCall(opt);
assertTrue(opt());
assertTrue(opt());